cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
 
ISE 2.3 Patch 7 has been posted. This will be the last patch for the ISE 2.3 release!
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

97
Views
5
Helpful
4
Replies
Beginner

Manual Authz assignment to new endpoint

Since ISE gains the most sensor data about an endpoint after it has received its DHCP lease, I need this to occur before I can create a well designed profile for the new device.

What I don't want to do is open up DHCP to any device that plugs into the network.

 

What I am hoping to do is plug in a new device, choose it from the endpoints list and manually assign an authz policy that will give it DHCP. Once ISE fully profiles the device, then I can use those attributes to build a well designed policy.

 

Is there a function in ISE to manually assign an authz policy to an endpoint?

Everyone's tags (3)
1 ACCEPTED SOLUTION

Accepted Solutions
VIP Advisor

Re: Manual Authz assignment to new endpoint

Hi,

You can create an identity group called pre-profile and create a policy to
match this group and assign author profile. Then you can assign your
endpoints manually to the group (static assigment). This will give them the
initial policy which can all them to get dhcp. Then if the profile is
changed and matched another policy, new author policy will be applied.

Note that the pre-profile policy should be at the bottom of your policy set
to be last match
4 REPLIES 4
VIP Advisor

Re: Manual Authz assignment to new endpoint

Hi,

You can create an identity group called pre-profile and create a policy to
match this group and assign author profile. Then you can assign your
endpoints manually to the group (static assigment). This will give them the
initial policy which can all them to get dhcp. Then if the profile is
changed and matched another policy, new author policy will be applied.

Note that the pre-profile policy should be at the bottom of your policy set
to be last match
Cisco Employee

Re: Manual Authz assignment to new endpoint

There are a number of ways you can achieve this but just to name a few:

- Prer-defined Identity Group with the list of mac addresses

- Match based on mac OUI

- Match based on NDGs , NAS IP adress , NAS port type and the list goes on...

 

Highlighted
Beginner

Re: Manual Authz assignment to new endpoint

Thank you

I am familiar with creating policies to match these objects, I was hoping there was a "manual override" in a sense where I could choose the device from the endpoints list and manually assign the authz policy temporarily.

Cisco Employee

Re: Manual Authz assignment to new endpoint

I believe you already got the idea. ISE does not work that way. The closest is in Mohammed al Baqari's response.